CVE-2026-121734

MediumCVSS 6.5/10Last modified Nov 12, 2026

Description

ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
zane-opszane-ops>= 1.14.0, < 1.15.2

References

Timeline

Published
Nov 3, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1217353.7blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accoCVE-2026-1217365.3NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauCVE-2026-121737When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxygen's coroutine-based CVE-2026-121748.8A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greCVE-2026-1217417.8Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2026-1217427.8Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execuCVE-2026-1217437.8Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackCVE-2026-1217447.8Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attacCVE-2026-1217452.5Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, whCVE-2026-1217465.5Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `nCVE-2026-1217475.5Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvmCVE-2026-1217483.6Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, wh
CVE-2026-121734: Medium severity, CVSS 6.5 | Vulnix